T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/sentry.py:482- Finding
Unvalidated file paths permit operations outside the selected workspace
- Content
View full analysis
0: # Create .bak backup before modifying bak = filepath.with_suffix(filepath.suffix + ".bak") shutil.copy2(filepath, bak) # Write redacted content filepath.write_text("\n".join(new_lines), encoding="utf-8") return total_redacted, findings ``` ```python if filepath: fpath = workspace / filepath if not fpath.exists(): print(f"File not found: {filepath}") return 1 if is_binary(fpath): print(f"Skipping binary file: {filepath}") return 0 count, findings = _redact_file(fpath, workspace) ``` The quarantine and restoration commands use the same unsafe path construction: ```python def cmd_quarantine(workspace, filepath): """Move a file containing secrets to quarantine with metadata.""" fpath = workspace / filepath if not fpath.exists(): print(f"File not found: {filepath}") return 1 # Scan the file first findings = [] if not is_binary(fpath): findings = scan_file(fpath, workspace) # Create quarantine directory qdir = quarantine_base(workspace) qdir.mkdir(parents=True, exist_ok=True) # Determine quarantine destination (preserve relative structure) rel = Path(filepath) dest = qdir / rel dest.parent.mkdir(parents=True, exist_ok=True) # Move file to quarantine shutil.move(str(fpa ...[truncated 2898 chars]- Remediation
View remediation